UBUNTU-CVE-2026-61637: Medium severity ubuntu/icingaweb2 vulnerability

Published Nov 12, 2026

Updated

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. For this to succeed, the victim's locale in Icinga Web must be different from enUS. This issue has been patched in versions 2.12.7 and 2.13.1.

Affected Software

6 affected components

ubuntu/icingaweb2*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Icinga Web 2 to a version that resolves this vulnerability.
Fixed in 2.12.7
Upgrade
Upgrade Icinga Web 2 to a version that resolves this vulnerability.
Fixed in 2.13.1

Event History

Nov 12, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Authenticated Icinga Web 2 users, or users who can authenticate, are exposed if their Icinga Web locale is set to a value other than en_US. The issue relies on the victim visiting an attacker-crafted URL.

Are default locale settings affected?

The issue does not succeed when the victim's Icinga Web locale is en_US. Users configured with a different locale are affected in vulnerable versions.

Which versions contain the fix?

The issue is patched in Icinga Web 2 versions 2.12.7 and 2.13.1. Versions prior to those releases are affected under the stated locale and user-interaction conditions.